Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're developing a service, that encrypt e-mail with AES algorithm.

Keys are stored in our server.

We thought about having an expiration service, that is deleting the key from our server. This means that the message would become virtually unrecoverable.

It is open worldwide, but I fear of USA :) Servers are in USA, but they can easily be moved.

Is this against some internet regulation or something?

share|improve this question
you might want to add the country that this service will operate in to your question, as it will mainly be local laws that determine whether you have a problem here. – Rоry McCune Aug 6 '12 at 17:44
up vote 3 down vote accepted

As far as I can tell (and IANAL), all the broad-scope laws requiring information retention by corporations apply to publicly-traded corporations. Private companies are free to operate in secrecy destroy any information they see fit, except in the case of pending litigation or other court order.

share|improve this answer
We need to get SE to automatically add a Wiki link and/or mouse-over definition for "IANAL". Otherwise, the Internet might think we're a bunch of sickos. Not that they'd necessarily be wrong in that assessment, but they should at least have the right reason... ;-) – Iszi Aug 7 '12 at 1:04

It is not against the law within the USA, though there have been attempts to pass a data retention law. However, Europe requires data retention in some areas starting at six months. So, if your company is a US company and your server is in it you're safe. Same goes to other countries without these laws. If your company or server is one of these countries, you are subject to their laws.

Wikipeida Reference


"Internet service providers must retain all data for at least 12 months"


"Telecommunication data are stored for six months in the case of data related to Internet, Internet email and Internet..."

*Note: The FBI can also request records of email addresses sent and recieved, but not the content of the message. NSL (same article)

share|improve this answer
I believe that is so, possibly Europe too. Correct me if I'm wrong, but I think I saw a news article on it a few years back. – Travis Pessetto Aug 6 '12 at 18:38
@curiousguy I double checked and found out it was just a proposed law, however Europe is stricter updating my answer now. – Travis Pessetto Aug 6 '12 at 18:44
@curiousguy removed it and gave a more general reference. – Travis Pessetto Aug 6 '12 at 18:48
Italy "The law does not specify exactly what traffic data must be retained. There is no requirement to store the content of internet communications." So... the statement is absolutely meaningless. Data must be retained, but you don't know which data. Typically Italian! (In Italy the prison administration cannot even read letters to/from prisoners.) – curiousguy Aug 6 '12 at 19:07

There won't be any Internet regulation as such which would require retention, but local laws will apply.

So it will completely depend on the country which you're operating the service in and the laws applicable there.

The one I know a little about (although IANAL) is the UK, where there it's an offence to fail to provide decryption keys/passwords to the authorities under some circumstances. However I believe, that's based on the idea that you know the key. If you've destroyed it and can prove that that's the case then in my personal opinion you wouldn't fall foul of that one..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.